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REMARKS / ARGUMENTS 



In response to the Office Action mailed November 28, 2005 ("Office Action"), 
Applicants respectfully request that the Office enter the amendments set forth above 
and consider the following remarks. By this response, claims 1-8, 16, 18, and 19 are 
amended. Representative support for the amendments can be found on pages 24-33 
of the specification. After entry of this paper, claims 1-20 will remain pending in this 
application. 

In the Office Action, the Examiner: (i) rejected claim 6 under 35 U.S.C. § 1 12, 
second paragraph, as being incomplete; (ii) rejected claims 1-3, 5, 7-9 and 14-20 
under 35 U.S.C. § 102(e) as being anticipated by U.S. Patent No. 6 t 088,801 to 
Grecsek ("Grecsek"); (iii) rejected claims 4, 6 and 10 under 35 U.S.C. § 103(a) as 
being unpatentable over Grecsek in view of U.S. Patent No. 6,064,739 to Davis 
("Davis"); (iv) rejected claim 11 under 35 U.S.C. § 103(a) as being unpatentable over 
Grecsek in view of Davis and further in view of U.S. Patent No. 6,236,727 to Ciacelli 
("Ciacelli"); and (v) rejected claims 12 and 13 under 35 U.S.C. § 103(a) as being 
unpatentable over Grecsek in view of European Patent No. EP0915620 to Shimada 
("Shimada"). 

On March 2, 2006, the Applicants' representatives, Mr. McDow and Mr. Lentini, 
had a teleconference regarding the § 102 and 103 rejections with Examiner Chen; 
Applicants thank the Examiner for the courtesies and helpful discussion, in which 
amended claim language for the independent claims was discussed. Applicants' 
summary here responds to the Examiner Summary paper mailed March 8, 2006, and 
is in accord with 37 C.F.R. § 1.133(b), thus no further written statement regarding this 
call is believed necessary at this time. 

Rejection of Claim 6 under 35 U.S.C. 5 112. second paragraph 

Claim 6 was rejected under 35 U.S.C. § 112, second paragraph, as being 
incomplete for omitting the elements "encrypted electronic content to be decrypted." 
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Applicants believe this rejection is moot in light of the amendments made to claim 6, 
and thus respectfully request that this rejection be withdrawn. 

Rejection of 1-3, 5. 7-9, and 14-20 under 35 U.S.C. § 102(e) 

Claims 1-3, 5, 7-9, and 14-20 were rejected under 35 U.S.C. § 102(e) as being 
anticipated by Grecsek. These rejections are respectfully traversed in view of the 
following remarks, 

Claim 1 includes the unique limitations of evaluating one or more predefined 
characteristics of one or more software modules to determine If the one or more 
software modules are operable to process electronic media content in an authorized 
manner, in which the evaluation includes operating a protection mechanism selected 
from the group consisting of: evaluating whether the one or more software modules 
make calls to certain system interfaces; determining whether the one or more software 
modules include one or more predefined code sequences associated with undesirable 
behavior; analyzing dynamic timing characteristics of the one or more software 
modules for anomalous timing characteristics indicative of invalid or malicious activity; 
determining whether the one or more software modules are included on a list of 
trusted software modules; determining whether the one or more software modules are 
included on a list of untrusted software modules; and determining whether the one or 
more software modules have been digitally signed by a trusted party. These features 
are not shown or suggested by Grecsek. 

Claim 5 includes the unique features of monitoring at least one system interface 
for electronic data, generating an identifier associated with the electronic data, 
comparing the identifier with an identifier associated with a piece of electronic media 
content, and, if the two identifiers are not related in a predefined manner, taking a 
predefined defensive action selected from the group consisting of: modifying at least a 
portion of the piece of electronic data, or preventing the transfer of at least a portion of 
the piece of electronic data to an output device via the system interface. These 
features are not shown or suggested by Grecsek. 
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Claims 2-3, 7-9, and 14-20 are ultimately dependent from claims 1 or 5, 
respectively, and are thus allowable for at least the reasons set forth above in 
connection with claims 1 and 5. 

Applicants therefore respectfully request that the Examiner withdraw the 
rejections of claims 1-3, 5, 7-9, and 14-20 and allow these claims. 

Rejection of Claims 4. 6. and 10 under 35 U»S,C § 103(a) 

Claims 4, 6, and 10 were rejected under 35 U.S.C. § 103(a) as being 
unpatentable over Grecsek In view of Davis. These rejections are respectfully 
traversed in view of the following remarks. 

Claim 4 includes the unique limitations of means for evaluating one or more 
predefined characteristics of one or more drivers responsible for handling electronic 
media content, in which the means for evaluating includes means for operating a 
protection mechanism selected from the group consisting of: means for evaluating 
whether the one or more drivers make calls to certain system interfaces; means for 
determining whether the one or more drivers include one or more predefined code 
sequences associated with undesirable behavior; means for analyzing dynamic timfng 
characteristics of the one or more drivers for anomalous timing characteristics 
indicative of invalid or malicious activity; means for determining whether the one or 
more drivers are included on a list of trusted drivers; means for determining whether 
the one or more drivers are included on a list of untrusted drivers; and means for 
determining whether the one or more drivers have been digitally signed by a trusted 
party. These features are not shown or suggested by Grecsek. 

Moreover, Davis does not cure the failings of Grecsek noted above. In 
particular, Davis does note show or suggest the unique combination of claim 4 
described above. Again, these unique details are provided only by Applicants' 
invention. 

Davis describes protecting video data from unauthorized copying during 
transmission of the video data from storage to the viewing device using a first 
encryption engine to decrypt previously encrypted video data and re-encrypt that data, 
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a frame buffer to store the newly encrypted video data, and a second encryption 
engine to decrypt the video data in the frame buffer prior to transmission to an analog 
signal for display. Davis at Column 2, lines 19-29. The components are encased in a 
hardware envelope that prevents interception of the decrypted video data. Id. at lines 
63-65. 

Davis does not show or suggest the disclosure missing from Grecsek, viz.: 
means for evaluating whether the one or more drivers make calls to certain system 
interfaces; means for determining whether the one or more drivers include one or 
more predefined code sequences associated with undesirable behavior; means for 
analyzing dynamic timing characteristics of the one or more drivers for anomalous 
timing characteristics indicative of invalid or malicious activity; means for determining 
whether the one or more drivers are included on a list of trusted drivers; means for 
determining whether the one or more drivers are included on a list of untrusted drivers; 
or means for determining whether the one or more drivers have been digitally signed 
by a trusted party. 

Moreover, as noted in Applicants' previous response, the Examiner's 
combination of Davis and Grecsek would violate the requirements of MP,E.P. § 
2143.01, as the combination would render each of the cited references unsatisfactory 
for its intended purpose. Grecsek describes systems and methods for identifying 
malicious software code before the code is executed on a computer system. Grecsek 
at Column 2, lines 40-45. The systems and methods described in Grecsek "provide a 
means for determining the capabilities of [a potentially malicious] process before it 
executes." Id. at lines 23-27. A process that is determined to include potentially 
dangerous operations can be denied access to system resources or have certain 
operations disabled. See, Column 4, lines 21-36. 

Applicants note that one of ordinary skill in the art would not have any 
motivation to combine Davis with Grecsek without the use of prohibited hindsight, 
since the two reference address different problems and operate on different types of 
data. Davis is concerned with copy protection; not preventing the execution of 
malicious operations. The methods and systems described by Grecsek are directed 
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to evaluating program operations, and do not address securing data using an 
encryption-decryption scheme within a separate hardware device. Conversely, the 
encryption-decryption methods and systems described |n Davis do not relate to 
identifying malicious code and preventing the execution of such code. The Examiner 
has not presented any argument or evidence to explain why or how one of ordinary 
skill would combine these two very different descriptions to obtain the invention as 
claimed. 

Claims 6 and 10 are dependent on claim 5, and thus are allowable for at least 
the reasons set forth above in connection with claim 5, In addition, Applicants 
respectfully submit that Davis fails to cure the deficiencies of Grecsek, noted above. 

Applicants therefore respectfully request that the Examiner withdraw the 
rejection of claims 4, 6, and 10 and allow these claims. 

Rejection of Claim 11 under 35 U.S.C. S 103(a) 

Claim 11 was rejected under 35 U.S.C. § 103(a) as being unpatentable over 
Grecsek in view of Davis and further in view of Ciacelli. 

Claim 1 1 is ultimately dependent from claim 5, however, and is thus allowable 
for at least the reasons set forth above in connection with claim 5. In addition, 
Applicants respectfully submit that combining Ciacelli with Grecsek and Davis would 
fail to cure the deficiencies of Grecsek and Davis, noted above. Thus r Applicants 
respectfully request that the Examiner withdraw the rejection of claim 11 and allow this 
claim. 

Rejection of Claims 12 and 13 under 35 U.S.C, § 103(a) 

Claims 12 and 13 were rejected under 35 U.S.C. § 103(a) as being 
unpatentable over Grecsek and in view of Shimada. 

Claims 12 and 13 are dependent from claim 5, however, and are thus allowable 
for at least the reasons set forth above in connection with claim 5. In addition, 
Applicants respectfully submit that combining Shimada with Grecsek would fail to cure 



-11- 



PAGE 12/14 * RCVDAT 3/15/2006 9:11:02 PM [Eastern Standard Time] * SVR:USPT0-EFXRF-1/9 * DNISOTOO * CSID:650 849 6666 * DURATION (mm-ss):05-18 



■flAR-15-2006 MED 06:13 PM FINNEGAN HENDERSON FAX NO. 650 849 6666 P. 13 



Appln. No. 09/653,517 
Amdt/Response filed March 15 r 2006 
reply to Office Action of Nov. 28, 2005 



PATENT 
Customer No. 22,852 
Attorney Docket No. 7451 .0029-00 
Intertrust Ret. No. IT-28.1 



the deficiencies of Grecsek, noted above. Thus, Applicants respectfully request that 
the Examiner withdraw the rejection of claims 12 and 13 and allow these claims. 



In view of the foregoing remarks, Applicants submit that the pending claims are 
in allowable form, and respectfully request reconsideration of the rejections and timely 
allowance of the claims. 

Please grant any extensions of time required to enter this response and charge 
any additional required fees to our Deposit Account No. 06-0916. 



Finnegan Henderson Farabow 

Garrett & Dunner LLP. 
901 New York Ave., N.W. 
Washington, D.C. 20001 
Attorney direct (650) 849-6643 



CONCLUSION 



Respectfully submitted, 



FINNEGAN, HENDERSON, FARABOW, 
GARRETT & DUNNER, LLP. 



Dated: March 15, 2006 




Andrew B. gfchwaab 
Reg. No. 38,611 
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